NewsJuly 18, 2017 @ 12:55 PM

WordPress Sites at Risk From PHP Code Execution

New attacks against unfinished installations of WordPress aim to give attackers admin access and the opportunity to run PHP code.

The campaign, which was revealed by security specialist Wordfence, peaked during May and June when attackers targeted recently installed, but not configured, instances WordPress, SecurityWeek reported. Outsiders can use a successful attack to take over the new WordPress website and then potentially gain access to the entire hosting account.

Accessing WordPress Sites

According to the SecurityWeek article, many WordPress users install the platform by either unzipping the archive into a directory on their hosting account or by using a one-click installer from a hosting provider. But the process remains incomplete until a user creates a configuration file, and those who fail to complete installation leave themselves open to attack. In a blog post for Wordfence, chief executive Mark Maunder said his firm noticed that these high-level attackers started targeting unfinished WordPress installations.

Attackers scan for the setup URL and identify new instances of WordPress in which a user has uploaded the WordPress content management system but not completed the configuration. Such sites are open to outside connections, making it possible for external parties to access and complete the installation on the user’s behalf.

Malicious actors who discover an unfinished install can click through language selection and an introductory message before entering their own database-server information. WordPress then confirms that it can communicate with the database, allowing the outsider to complete installation, create an admin account and sign in to WordPress on the victim’s server.

The Dangers of PHP Code Execution

An attacker with admin access to a WordPress website can execute any PHP code and can undertake a range of malicious activities. Wordfence said a common action is to install a malicious shell in a hosting account. Such errant activity allows an attacker to access all files, websites and even databases on a WordPress account.

Wordfence suggested that there are several ways to complete this task, such as launching a theme and inserting PHP code, or creating and uploading a custom plug-in.

If news of the PHP code threat is not bad enough, a Wordfence report warned that the number of daily complex attacks against WordPress rose to 7.2 million in June 2017, up 32 percent from May. The average number of daily brute-force attacks increased by 36 percent month to month, with a peak level at more than 41 million.

Responding Effectively

Security experts suggested that incomplete WordPress installations remain a threat. One simple mitigation step is to complete configuration during the installation process. In his blog post for Wordfence, Maunder suggested that website admins could scan their hosting accounts for incomplete installations. Monitoring and auditing can also provide a further level of protection, he said.

Site owners should take note of the ever-growing threat from both unfinished WordPress installations and PHP code violations. They should work to fill potential security holes by completing configuration exercises, and by drawing on monitoring and auditing best practices.

Share this Article:
Mark Samuels

Tech Journalist

Mark Samuels is an experienced business technology journalist with an outstanding track record in research. He specializes in the role of chief information officers (CIOs) and is adept at helping executives understand the business benefits of complex technologies. Key areas of interest include innovation, digital transformation, cloud computing, mobility, information security, ecommerce and big data. Mark has written articles for national newspapers, including The Guardian, The Times and The Sunday Times. He has also produced features and columns for a range of IT trade publications, such as Computer Weekly, ZDNet, Tech Republic, IT Pro, Channel Pro, CBR and The Register.